Terms and Conditions Relating to Protected Health Information ( City PHI Terms ) Revised and Effective as of September 23, 2013

Terms and Conditions Relating to Protected Health Information ( City PHI Terms ) Revised and Effective as of September 23, 2013 The City of Philadelphia is a Covered Entity as defined in the regulations issued pursuant to the Health Insurance Portability and Accountability Act of 1996 ( HIPAA ). The City s business activities include both 1) functions which make the City a Covered Entity, and therefore, subject to HIPAA, and 2) functions that are not subject to HIPAA. In accordance with 45 CFR 164.105(a)(2)(iii)(D), the City has designated certain departments and units of the City as health care components that must comply with the HIPAA Rules (defined below). These health care components are referred to collectively as Covered Components in these Terms and Conditions Relating to Protected Health Information ( City PHI Terms ). These City PHI Terms shall apply to any provider, contractor, or vendor of the City ( Provider ) that, with respect to any agreement entered into by the City (each referred to in these City PHI Terms as a Contract ), falls within the definition of a Business Associate in 45 CFR 160.103, including but not limited to any Provider who pursuant to the Contract: (1) creates, receives, maintains, or transmits Protected Health Information (as defined below) on behalf of a Covered Component (whether or not the City department or unit through which the City entered into the Contract is a Covered Component) for a function or activity described in paragraph (1)(i) of the definition of a Business Associate in 45 CFR 160.103; (2) provides to or for a Covered Component a service described in paragraph (1)(ii) of the definition of a Business Associate in 45 CFR 160.103, which may involve the disclosure of Protected Health Information from the City (or from another Business Associate of the City) to the Provider or someone acting for or on behalf of the Provider; (3) provides data transmission services that require access on a routine basis to Protected Health Information; or (4) offers a personal health record to one or more individuals on behalf of a Covered Component. The term Contract shall include, without limitation, a contract procured by competitive sealed bid pursuant to Section 8-200 of the Philadelphia Home Rule Charter, a professional services contract, or a miscellaneous purchase order. The Covered Components of the City as of August 8, 2013 include: Ambulatory Health Services, a unit of the Philadelphia Department of Public Health (PDPH); Office of Behavioral Health and Intellectual disability Services; Philadelphia Nursing Home (a unit of PDPH); Benefits Administration Unit of the Office of Human Resources; Emergency Medical Services (a unit of the Philadelphia Fire Department); and Philadelphia Public Health Laboratory (a unit of PDPH). Capitalized terms used, but not otherwise defined, in these City PHI Terms shall have the same meaning as those terms are given in the HIPAA Rules (as defined below). Any reference to a statute or regulation in these City PHI Terms shall refer to the statute or regulation referenced, as may be amended or superseded from time to time. Page 1 of 13

(a) Definitions. For purposes of these City PHI Terms and notwithstanding anything in the Contract to the contrary, the terms enumerated in this Section (a) shall be defined as follows: (1) Agent. Agent shall mean an agent of Provider as determined in accordance with the federal common law of agency. (2) Applicable Law. Applicable Law means all applicable present and future federal, state or local laws, ordinances, executive orders, rules, regulations and all court orders, injunctions, decrees and other official interpretations thereof of any federal, state or local court, administrative agency or governmental body, including the City, the Commonwealth of Pennsylvania and the United States of America. Applicable Law includes, without limitation all specific laws and regulations referred to in these City PHI Terms. (3) Breach. Breach shall have the same meaning as the term breach in 45 CFR 164.402. (4) Breach Notification Rule. Breach Notification Rule shall mean the Final Rule requiring notification of Breaches of Unsecured Protected Health Information set forth at 45 CFR 164.400 through 164.414. (5) Business Associate. Business Associate shall have the same meaning as the term business associate in 45 CFR 160.103. (6) City PHI Terms. City PHI Terms shall mean these Terms and Conditions Relating to Protected Health Information. (7) Contract. Contract shall mean this professional services contract, miscellaneous purchase order, Procurement Contract, or other agreement of the parties including any and all documents and exhibits incorporated therein by reference or attached thereto and any and all amendments or changes thereto in accordance with the Contract. (8) Covered Component. Covered Component shall mean a health care component designated by the City in accordance with 45 CFR 164.105(a)(2)(iii)(D). (9) Covered Entity. Covered Entity shall have the same meaning as the term covered entity in 45 CFR 160.103. (10) Department. Department shall mean the department, board, agency, or commission of the City through which the City entered into the Contract. (11) Discovery of an Incident. Consistent with 45 CFR 164.410 (a)(2), Discovery of an Incident shall mean that Provider, or an employee, officer, or other Agent of Provider, knows of an Incident or by the exercise of reasonable diligence should have known of an Incident. (12) Electronic Protected Health Information. Electronic Protected Health Information (sometimes referred to as EPHI ) shall have the same meaning as the term electronic protected health information in 45 CFR 160.103, limited to information received Page 2 of 13

from the City (or from another Business Associate of the City) or information accessed, created, received, maintained, retained, modified, transmitted, destroyed, or otherwise held, used, or disclosed by Provider (or a Subcontractor or Agent) for or on behalf of the City pursuant to the Contract. (13) Event of Default. Event of Default shall mean any failure by Provider to comply with any provision of the Contract. (14) HIPAA. HIPAA shall mean the Health Insurance Portability and Accountability Act of 1996, Public Law No. 104-191, 104 th Congress. (15) HIPAA Rules. HIPAA Rules shall mean the Privacy, Security, Breach Notification, and Enforcement Rules set forth in 45 CFR Part 160 and Part 164. (16) HITECH Act. HITECH Act shall mean the Health Information Technology for Economic and Clinical Health Act, Public Law No. 111-05, 111th Congress (2009). (17) Incident. Incident shall mean (a) any Security Incident that results in the unauthorized access, use, disclosure, modification, or destruction of EPHI or interference with system operations in an information system of Provider or of an Agent or Subcontractor, (b) any use or disclosure of Protected Health Information not authorized by the Contract, or (c) any Breach of Unsecured Protected Health Information. (18) Individual. As defined in 45 CFR 160.103, Individual shall mean the person who is the subject of Protected Health Information and for purposes of Section (c)(7) through Section (c)(10) of these City PHI Terms shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g). (19) Materials. Materials shall mean any and all reports, records, documents, documentation, information, supplies, plans, original drawings, specifications, computations, sketches, renderings, arrangements, videos, pamphlets, advertisements, statistics, and other data, computer tapes, computer software, and other tangible work product or materials prepared or developed by Provider in connection with the Services, or for Provider by a Subcontractor in connection with the Services, and supplied to the City by Provider or a Subcontractor pursuant to the Contract. City. (20) MPO. MPO shall mean a miscellaneous purchase order entered into by the (21) Other Privacy Laws. The Pennsylvania Mental Health Procedures Act (50 P.S. 7111 et seq.), Pennsylvania Mental Health Treatment Regulations (55 Pa. Code 5100.31 et seq.), Pennsylvania Confidentiality of HIV-Related Information Act (35 P.S. 7601 et seq.), federal substance abuse treatment confidentiality law and regulations codified as 42 USC 290dd- 2 and 42 CFR Part 2, Pennsylvania Drug and Alcohol Abuse Control Act (71 P.S. 1690.101 et seq.), Pennsylvania Breach of Personal Information Notification Act (73 P. S. 2301 et seq.), Identity Theft Prevention Rules under 16 CFR 681.1, and any other Pennsylvania and federal laws that protect the privacy, confidentiality, integrity, and security of individually identifiable health information shall collectively be referred to in these City PHI Terms as "Other Privacy Laws. Page 3 of 13

(22) Person. Person means any individual, sole proprietorship, associate, company, firm partnership, limited partnership, joint venture, corporation, limited liability company or other form of entity or association recognized by law. (23) Privacy Rule. "Privacy Rule" shall mean Subparts A and E of Part 164 of Title 45 of the Code of Federal Regulations. (24) Procurement Contract. Procurement Contract shall mean a contract procured by a competitive sealed bid process pursuant to Section 8-200 of the Philadelphia Home Rule Charter. (25) Protected Health Information. "Protected Health Information" (sometimes referred to as PHI ) shall have the same meaning as the term "protected health information" in 45 CFR 160.103, limited to information received from the City (or from another Business Associate of the City) or information accessed, created, received, maintained, retained, modified, transmitted, destroyed, or otherwise held, used or disclosed by Provider (or a Subcontractor or Agent) for or on behalf of the City pursuant to the Contract. (26) Provider. Provider shall mean any provider, contractor, or vendor of the City that with respect to the Contract falls within the definition of a Business Associate in 45 CFR 160.103, including but not limited to any Provider that pursuant to the Contract: (1) creates, receives, maintains, or transmits Protected Health Information on behalf of a Covered Component (whether or not the City department or agency through which the City entered into the Contract is a Covered Component) for a function or activity described in paragraph (1)(i) of the definition of a Business Associate in 45 CFR 160.103; (2) provides to or for a Covered Component a service described in paragraph (1)(ii) of the definition of a Business Associate in 45 CFR 160.103, which may involve the disclosure of Protected Health Information from the City (or from another Business Associate of the City) to the Provider or someone acting for or on behalf of the Provider; (3) provides data transmission services that require access on a routine basis to Protected Health Information; or (4) offers a personal health record to one or more individuals on behalf of a Covered Component. (27) Required By Law. "Required By Law" shall have the same meaning as the term "required by law" in 45 CFR 164.103. (28) Responsible Official. Responsible Official shall mean: (1) for MPOs, the person identified as Requisitioner on the first page (titled Miscellaneous Order ) of the MPO; (2) for Procurement Contracts, the Director of Purchasing of Services, Supplies and Equipment for the Procurement Department; and (3) for other Contracts, the person identified as the Responsible Official in the Contract. (29) Scope of Services. Scope of Services shall mean: (1) for MPOs, the services identified on the first page (titled Miscellaneous Order ) of the MPO and, if applicable, in the proposal or scope of services attached to the MPO; (2) for Procurement Contracts, Section 2 (Specifications) of the part of the Contract titled Invitation and Bid ; and (3) for other Contracts, the services to be performed by Provider as specified in an exhibit to the Provider Agreement. Page 4 of 13

(30) Secretary. "Secretary" shall mean the Secretary of the U. S. Department of Health and Human Services or the Secretary s designee. (31) Security Incident. As defined in 45 CFR 164.304, Security Incident shall mean the attempted or successful unauthorized access, use, disclosure, or destruction of information or interference with system operations in an information system. (32) Security Rule. Security Rule shall mean Subparts A and C of Part 164 of Title 45 of the Code of Federal Regulations. (33) Services. Services means the work to be performed under the Contract as specified in the Scope of Services. (34) Subcontract. Subcontract means a contract made between Provider and a Subcontractor providing for the completion of some part or parts of the Services or Materials by a Subcontractor. (35) Subcontractor. Notwithstanding anything to the contrary in the Contract, the term Subcontractor when used in these City PHI Terms shall mean a Person who under a contract or other arrangement with Provider performs or assists in the performance of some part of the Services or Materials or any other function or activity involving the use or disclosure of or access to Protected Health Information. (36) Unsecured Protected Health Information. Unsecured Protected Health Information shall have the same meaning as the term unsecured protected health information in 45 CFR 164.402, limited to information received from the City (or from another Business Associate of the City) or accessed, created, received, maintained, retained, modified, transmitted, destroyed, or otherwise held, used or disclosed by Provider (or a Subcontractor or Agent) for or on behalf of the City pursuant to the Contract. (b) Obligations and Activities of Provider. (1) Provider shall not use, disclose, or maintain Protected Health Information other than as expressly authorized or required by the Contract or as Required By Law. (2) Provider shall use appropriate safeguards to prevent the use or disclosure of Protected Health Information other than as provided for by the Contract and, with respect to Electronic Protected Health Information, shall comply with all the requirements of Subpart C of Part 164 of Title 45 of the Code of Federal Regulations that apply to Business Associates. Provider understands and agrees that failure to comply with these requirements may result in civil or criminal penalties pursuant to 13401(b) and 13404 of the HITECH Act. (3) To the extent Provider is to carry out one or more of the City s obligations under the Privacy Rule, Provider shall comply with the requirements of the Privacy Rule that apply to the City in the performance of such obligation(s). (4) Without unreasonable delay after Provider becomes aware of an Incident, or within the time prescribed by Applicable Law, whichever is shorter, (i) Provider shall mitigate, Page 5 of 13

to the extent practicable, any harmful effect of any Incident or any use or disclosure of Protected Health Information by Provider (or a Subcontractor or Agent) in violation of the Privacy Rule or these City PHI Terms and (ii) shall use all reasonable steps to cure any Event of Default arising out of these City PHI Terms. Provider s obligation under this paragraph shall not relieve Provider of its obligation to cure an Event of Default to the extent otherwise required by the Contract or Applicable Law. (5) In accordance with 45 CFR 164.502(e)(1)(ii) and 45 CFR 164.308(b)(2), if applicable, Provider shall ensure that any Subcontractors that create, receive, maintain, or transmit Protected Health Information, in any format, on behalf of Provider agree to the same restrictions, conditions, and requirements that apply to Provider with respect to such information and shall ensure that any such Subcontractors enter into a business associate agreement or other arrangement that complies with the applicable requirements of 45 CFR 164.504(e) and 45 CFR 164.314(a). (6) Provider shall make its internal practices, books, and records relating to the use and disclosure of Protected Health Information available to the City and to the Secretary, in a time and manner designated by the head of the Covered Component for which Services are being rendered pursuant to the Contract, the City s HIPAA Privacy Officer, or the Secretary, for purposes of determining the City's compliance with the Privacy Rule and Security Rule. Provider shall notify the head of the Covered Component for which Services are being rendered pursuant to the Contract and the City s HIPAA Privacy Officer in writing, as set forth in Section (d)(2) of these City PHI Terms, of any request from the Secretary for Provider s internal practices, books, and records within five (5) business days after receipt of such request and, at the same time or before it provides any information to the Secretary shall provide the City s Privacy Officer with a copy of such information. (7) Individual s Request for Access to PHI. Provider shall, following an Individual s or the City s written request from time to time, make available to the City or, at the City s direction, to an Individual, Protected Health Information in a Designated Record Set (as that term is defined in 45 CFR 164.510) in a time and manner that enables the City to meet its obligations under 45 CFR 164.524. Upon the City s written request, Provider shall provide to the HIPAA Privacy Officer of the Covered Component for which Services are being rendered pursuant to the Contract documentation of the Designated Record Sets that are subject to access by Individuals and the titles of and contact information for the persons or offices of Provider responsible for receiving and processing requests for access to PHI by Individuals. (8) Individual s Request for Amendment of PHI. As requested by the City or an Individual in writing from time to time and in the time and manner specified by the City, Provider shall (i) make any amendments to Protected Health Information in a Designated Record Set (as that term is defined in 45 CFR 164.510) as the City is required to make in accordance with 45 CFR 164.526 and (ii) make reasonable efforts to inform and provide the amendments to others who Provider knows have the Protected Health Information that is the subject of the amendment, and that may have relied, or could foreseeably rely, on the information to the detriment of the Individual. Upon the City s written request, Provider shall provide to the HIPAA Privacy Officer of the Covered Component for which Services are being rendered Page 6 of 13

pursuant to the Contract the titles and contact information of the persons or offices of Provider responsible for receiving and processing requests for amendments of PHI and retaining the documentation required by 45 CFR 164.530(j). (9) Documentation of Disclosures. Provider shall identify and document, and require any Subcontractors and Agents to identify and document, such disclosures of Protected Health Information and information related to disclosures as necessary to enable the City to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528. (10) Individual s Request for Accounting of Disclosures. If an Individual requests Provider to provide the Individual with an accounting of disclosures, Provider shall provide to the Individual, within fifty (50) days of such request an accounting of disclosures of Protected Health Information in such form and manner that enables the City to fulfill its obligations to respond to a request by an Individual for an accounting of disclosures in accordance with 45 CFR 164.528. If the City requests Provider to provide an accounting of disclosures for an Individual, Provider shall provide to the City or, at the City s direction, to the Individual, in a time that will enable the City to meet its obligations under the Privacy Rule, but no later than thirty (30) days after requested by the City to do so, information collected in accordance with Section (b)(9) of these City PHI Terms, in such form and manner that enables the City to fulfill its obligations to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528. (11) Minimum Necessary Standard. Except as otherwise expressly authorized in the Contract, Provider shall use, disclose or request only the minimum Protected Health Information necessary to accomplish the intended purpose of the use, disclosure, or request in accordance with 45 CFR 164.502(b) and shall provide access to such information only to those employees who have a need to know the information to carry out the intended purpose. (c) Permitted Uses and Disclosures by Provider. (1) Uses and Disclosures Authorized by the Contract. The City authorizes Provider to create, use, receive, and disclose the minimum Protected Health Information necessary to perform the Services and provide the Materials required by the Contract. (2) Creation of De-Identified Information, Limited Data Set and Provision of Data Aggregation Services. As requested by and subject to such limitations as may be imposed by the City in writing from time to time, Provider may use PHI to create information that is not individually identifiable health information in accordance with the specifications in 45 CFR 164.514(b), to create a limited data set that meets the specifications in 45 CFR 164.514(e)(2), or to provide data aggregation services as permitted in 45 CFR 164.504(e)(2)(i)(B). (3) Duty to Comply with the Privacy Rule and Other Privacy Laws. Provider may not use, disclose, or request Protected Health Information in a manner that would violate the Privacy Rule or Other Privacy Laws if done by the City except that Provider may provide data aggregation services to the extent permitted under Section (c)(2) of these City PHI Terms. Page 7 of 13

(d) Reporting Obligations. (1) Notice of Unauthorized Use or Disclosure of PHI, Security Incident, or Breach of Unsecured Protected Health Information. (i) Without unreasonable delay, and in no event later than five (5) business days after Provider becomes aware of an Incident, Provider shall give notice of such Incident to the head of each Covered Component for which Services are being rendered pursuant to the Contract and the HIPAA Privacy Officer of each Covered Component for which Services are being rendered pursuant to the Contract. Such notice shall be in writing, shall be given as set forth in Section (d)(2) of these City PHI Terms, and shall include a) a description of what happened, including the date of the Incident, the date of Discovery of the Incident, and how Provider learned of the Incident; b) the nature and extent of the Protected Health Information involved, including but not limited to the types of Protected Health Information (demographic, financial, or clinical), the types of identifiers (such as name, account number, or social security number) and any other information that could be used to identify an Individual or reveal a sensitive health condition; c) if applicable, steps Individuals should take to protect themselves from potential harm resulting from the Incident; d) a description of what Provider is doing to investigate the Incident, to mitigate harmful effects of the Incident, to lessen and assess the risk that the PHI has been compromised, and to protect against any further Incidents; e) the name, title, and address of the unauthorized person who used the Protected Health Information or to whom the disclosure was made; f) whether the Protected Health Information was actually acquired or viewed; g) contact procedures and information to enable the City to ask questions or learn additional information relating to the Incident; h) whether the Incident involved Unsecured Protected Health Information and, if not, Provider s basis for this conclusion; i) the approximate number of Individuals affected by the Incident (if number is not known, state whether number may involve more than 500 Individuals); j) the extent to which the risk to the Protected Health Information has been mitigated, and k) such other information relating to the Incident as Provider deems relevant to the City s review of the Incident. Provider shall not include any Protected Health Information in such notice. (ii) Without unreasonable delay after providing notice of an Incident pursuant to Section (d)(1)(i) of these City PHI Terms, and in no event later than fifteen (15) calendar days after becoming aware of such Incident, Provider shall provide in writing to the head and the HIPAA Privacy Officer of each Covered Component for which Services are being rendered pursuant to the Contract: a) Provider s conclusion as to whether the Incident falls within an exception to the duty of a Covered Entity to report the Incident under the Breach Notification Rule, if applicable, and, if so, Provider s basis for this conclusion; b) Provider s conclusion as to whether there is low probability that the privacy or security of the applicable Protected Health Information has been compromised and Provider s basis for this conclusion; and c) such other information as the City may request or Provider deems relevant to the City s review of the Incident. Provider shall provide to the head and the HIPAA Privacy Officer of each Covered Component for which Services are being rendered pursuant to the Contract updates to the written notices or reports required under Section (d)(1) of these City PHI Terms, which updates shall be provided without unreasonable delay from time to time as Provider becomes aware of any Page 8 of 13

information that Provider is required to report to the City under Section (d)(1) of these City PHI Terms or that the City is required to include in any notification to Individuals or the Secretary under Applicable Law. (iii) Upon the City s written request from time to time, Provider shall provide to the City s HIPAA Privacy Officer, without unreasonable delay and in no event later than fourteen (14) calendar days after the City makes each such request, the name and contact information of each Individual whose Unsecured Protected Health Information has been, or is reasonably believed by Provider to have been, accessed, acquired, used, or disclosed during the Incident and, if relevant to the Incident or the duty of the City to notify someone other than the Individual, the Individual s date of birth. (iv) Upon the City s written request from time to time, Provider shall provide to the City s HIPAA Privacy Officer, without unreasonable delay and in no event later than seven (7) business days after receiving such request, a written report that a) identifies patterns of activity that constitute Unsuccessful Security Incidents within the timeframe specified in the request, and b) states whether Provider believes its current defensive security measures are adequate to address such Unsuccessful Security Incidents and, if the security measures are not adequate, the specific measures Provider will implement to address the inadequacies and the date when each such measure will be implemented. To the extent such patterns of activity are tracked by Provider, Provider shall include in the report all patterns of activity that the City determines, in its sole discretion, are necessary to enable the City to assess the risk posed by the Unsuccessful Security Incidents within the specified timeframe and shall notify the City s HIPAA Privacy Officer when a measure that Provider agrees to implement to address an inadequacy is fully implemented and operational, For purposes of this paragraph, an Unsuccessful Security Incident shall mean the attempted unauthorized access, use, disclosure, modification, or destruction of information or interference with Provider s system operations used in connection with the Services, including (to the extent that Provider is aware) the attempted unauthorized access, use, disclosure, modification, or destruction of information or interference with any Agent s or Subcontractor s system operations used in connection with the Services. (2) Notices. Notwithstanding anything to the contrary in the Contract, any notification given pursuant to these City PHI Terms shall be in a writing delivered by fax and by overnight delivery service. In each case, such notices shall be sent to the address and fax number of the head of the applicable Covered Component(s), the HIPAA Privacy Officer of the applicable Covered Component(s), and the City s HIPAA Privacy Officer, as applicable, as set forth in this Section (d)(2) or to such other address and fax number for such individuals as the Responsible Official or the City s HIPAA Privacy Officer may specify in a notice sent to Provider in accordance with the Contract. If Services are being rendered to more than one Covered Component pursuant to the Contract or if a notice sent pursuant to these City PHI Terms is returned to Provider as undeliverable, a notice required to be given to the head or HIPAA Privacy Officer of a Covered Component pursuant to these City PHI Terms shall also be given to the Responsible Official and the City s HIPAA Privacy Officer. The address and fax number of the head and HIPAA Privacy Officer of each Covered Page 9 of 13

Component are as follows: Ambulatory Health Services Ambulatory Health Services Attn: Director Attn: HIPAA Privacy Officer Philadelphia Department of Public Health Philadelphia Department of Public Health Division of Clinical Services Director s Office 500 South Broad Street 3 rd Floor 500 South Broad Street 3 rd Floor Philadelphia, PA 19146 Philadelphia, PA 19146 Fax Number: (215) 685-6732 Fax Number: (215) 685-6732 Office of Behavioral Health and Office of Behavioral Health and Intellectual disability Services Intellectual disability Services Attn: Director Attn: HIPAA Privacy Officer City of Philadelphia City of Philadelphia 1101 Market Street 7 th floor 1101 Market Street - 7 th floor Philadelphia, PA 19107-2907 Philadelphia, PA 19107-2907 Fax: (215) 685-4751 Fax: (215) 685-5563 Benefits Administration Unit Benefits Administration Unit Attn: Deputy HR Director Employee Benefits Attn: HIPAA Privacy Officer City of Philadelphia City of Philadelphia Office of Human Resources Office of Human Resources 1401 J. F. Kennedy Blvd., Suite 1581 1401 J. F. Kennedy Blvd., Suite 1581 Philadelphia, PA 19102 Philadelphia, PA 19102 Fax: (215) 686-0889 Fax: (215) 686-0889 Emergency Medical Services Emergency Medical Services Attn: Fire Paramedic Chief Attn: HIPAA Privacy Officer EMS Administration Building EMS Administration Building 3061 Island Avenue 3061 Island Avenue Philadelphia, PA 19153 Philadelphia, PA 19153 Fax: (215) 685-4207 Fax: (215) 685-4208 Philadelphia Nursing Home Philadelphia Nursing Home c/o: Deputy Commissioner of Health Attn: HIPAA Privacy Officer Philadelphia Department of Public Health Philadelphia Department of Public Health 1401 J. F. Kennedy Blvd Room 600 1401 J. F. Kennedy Blvd Room 600 Philadelphia, PA 19102 Philadelphia, PA 19102 Fax Number: (215) 686-5209 Fax Number: (215) 685-5209 Page 10 of 13

Philadelphia Public Health Laboratory Philadelphia Public Health Laboratory Attn: Laboratory Operations Director Attn: HIPAA Privacy Officer/Operations Philadelphia Department of Public Health Director 500 S. Broad St. 3rd Floor, 19146 Philadelphia Department of Public Health Philadelphia, PA 19146 500 S. Broad St. 3rd Floor, 19146 Fax Number: 215-545-7297 Philadelphia, PA 19146 Fax Number: 215-545-7297 The address and fax number of the City s HIPAA Privacy Officer are as follows: City of Philadelphia Law Department Attn: HIPAA Privacy Officer 1515 Arch Street, 17 th Floor Philadelphia, PA 19102 Fax Number: (215) 683-5069 (3) Cooperation with the City. Provider shall cooperate with the City in investigating any Incident and in meeting the City s obligations under HIPAA, the HITECH Act, the HIPAA Rules, and the Other Privacy Laws. If the City determines that a Breach of Unsecured Protected Health Information must be reported to the U. S. Department of Health and Human Services ( HHS ), the City (and not Provider) shall report the Breach to HHS. As may be requested by the City from time to time after a Breach, Provider shall provide to the City full and timely assistance in compiling and producing the information and documentation needed for the submission to HHS and notification to Individuals affected by the Breach, including but not limited to preparing and submitting to the City s HIPAA Privacy Officer for approval the notification letters to Individuals affected by the Breach, delivering to the City an addressed envelope for each Individual to receive the notification, translating letters to foreign languages, Braille, or large text as necessary to comply with the City s obligations under Applicable Law, and providing the postage to cover the cost of mailing the notifications. (4) Responsibility for Costs - Breach of Unsecured Protected Health Information. To the extent an Incident occurs involving Unsecured Protected Health Information under the custody or control of Provider or a Subcontractor or Agent, then, in addition to any other obligation of Provider under the Contract, and notwithstanding any other provision in the Contract to the contrary, Provider will indemnify the City for (i) all costs and expenses the City incurs to investigate an Incident and, if the City determines that a Breach has or may have occurred, to comply with the notification and mitigation requirements of 45 CFR. 164.404, 164.406, 164.408, and 164.414, and (ii) any fees, fines, penalties, costs, expenses, and other liabilities assessed or imposed on the City as a result of the Incident. Nothing contained or waived in any provision of the Contract outside of this Section(d)(4) shall be deemed to limit, waive, or in any way modify Provider s obligations to the City under this Section (d)(4). (5) Responsibility for Costs - Pennsylvania Breach of Personal Information Notification Act. In addition to any other obligation of Provider under the Contract, and notwithstanding any other provision in the Contract to the contrary, in the event the City or any agency or administrative or judicial body determines that a Breach of Personal Information (as that term is defined in the Pennsylvania Breach of Personal Information Notification Act, 73 P. Page 11 of 13

S. 2301 (2005)) has occurred, Provider will indemnify the City for any fees, fines, penalties, costs, expenses, and other liabilities incurred by the City or assessed or imposed on the City as a result of such Breach of Personal Information to the extent the Breach of Personal Information involves Personal Information (as that term is defined in the Pennsylvania Breach of Personal Information Notification Act) under the custody or control of Provider or a Subcontractor or Agent. Nothing contained or waived in any provision of the Contract outside of this Section(d)(5) shall be deemed to limit, waive, or in any way modify Provider s obligations to the City under this Section (d)(5). (e) Obligations of City to Inform Provider of Privacy Practices and Restrictions. (1) The City shall notify Provider of any limitation(s) in a City s notice of privacy practices in accordance with 45 CFR 164.520, to the extent that such limitation may affect Provider's use or disclosure of Protected Health Information. (2) The City shall notify Provider of any changes in, or revocation of, permission by an Individual to use or disclose Protected Health Information, to the extent that such changes may affect Provider's use or disclosure of Protected Health Information. (3) The City shall notify Provider of any restriction on the use or disclosure of Protected Health Information that has been requested by an Individual and agreed to by the City in accordance with 45 CFR 164.522, to the extent that such restriction may affect Provider s use or disclosure of Protected Health Information. (f) Termination. (1) Termination for Cause. In addition to and without limiting any other termination rights or remedies of the City provided for in the Contract, the City shall have the right to terminate the Contract immediately if (i) upon becoming aware of an Event of Default arising out of these City PHI Terms, the City determines in its sole discretion that such Event of Default constitutes a material breach of these City PHI Terms and (ii) Provider fails to cure the Event of Default within ten (10) days after the City notifies Provider of the Event of Default. (2) Effect of Termination. At termination of the Contract for any reason, unless Provider is mandated by Applicable Law to retain the Protected Health Information or unless the City directs Provider, or agrees in writing to allow Provider, to retain the Protected Health Information after the Contract terminates, Provider shall return all Protected Health Information to the Responsible Official or, if directed by the Responsible Official in writing to do so, shall destroy all Protected Health Information that Provider still maintains or otherwise holds in any form, and Provider shall retain no copies of such information in any electronic, paper, or other form, format, or medium. To the extent Provider is mandated by Applicable Law or directed or authorized by the City to retain any Protected Health Information after the termination of the Contract, Provider agrees to extend the protections of these City PHI Terms to the information and limit further uses and disclosures strictly to those purposes that are mandated by Applicable Law or that are expressly authorized by the City in writing. At such time as Provider is no longer mandated by Applicable Law or directed or authorized by the City to retain the Protected Page 12 of 13

Health Information, Provider shall return to the Responsible Official or, if directed by the Responsible Official in writing to do so, shall destroy all Protected Health Information retained by Provider, and Provider shall retain no copies of such information in any electronic, paper, or other form, format, or medium. If Provider destroys any Protected Health Information, Provider agrees to use a technology or methodology that renders the Protected Health Information unusable, unreadable, or indecipherable to unauthorized individuals in accordance with the most recent guidance issued by the Secretary pursuant to the HITECH Act. The above notwithstanding, to the extent Provider, during the term of the Contract, maintains or otherwise holds any Protected Health Information for or on behalf of the City that the City has a legal obligation to retain under any local, state or federal records retention laws, Provider shall retain such Protected Health Information that is not returned to the City for the time period and in accordance with such retention laws. The foregoing paragraph shall apply to Protected Health Information in the possession of Subcontractors or Agents, shall be enforced by Provider with respect to such Subcontractors and Agents, and shall be incorporated in any Subcontract or other agreement between Provider and such Subcontractors or Agents for the performance of the Services or provision of the Materials. (g) Miscellaneous. (1) Privacy Law Modifications Notice. Notwithstanding anything to the contrary in the Contract, the Provider and the City agree that these City PHI Terms shall be deemed automatically modified as the City in its sole judgment deems necessary from time to time to insure continued compliance with the requirements of HIPAA, the HITECH Act, the HIPAA Rules, and Other Privacy Laws, and all regulations implemented pursuant thereto, such modification to be effective upon the City posting the modified Terms and Conditions Relating to Protected Health Information (referred to as City PHI Terms ) on the City s website (at https://secure.phila.gov/econtract/ under the About link). (2) Survival. In addition to and without limiting the survival of any other rights, obligations, or liabilities provided for in the Contract, the respective rights and obligations of Provider under Sections (d) and (f)(2) of these City PHI Terms shall survive the termination of the Contract. (3) Interpretation. Any ambiguity in these City PHI Terms shall be resolved to permit the City and require Provider to comply with HIPAA, the HITECH Act, the HIPAA Rules, and Other Privacy Laws. Page 13 of 13